ClawHub
Back to skill

Security audit

书库扫描入库

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently scans a user-chosen ebook folder and creates Obsidian notes, but users should be careful with the optional online search helper.

Install only if you are comfortable letting the skill read the ebook directory you choose and create persistent JSON/Markdown files in the output folder. Use a narrow source folder, choose a private output location, and review any search_book.ps1 helper before enabling online enrichment because book titles or metadata may be sent to an external search service.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (6)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def search_book(keyword, search_script):
    """调用PowerShell脚本搜索书籍简介"""
    try:
        result = subprocess.run(
            ['powershell', '-File', search_script, '-Keyword', keyword],
            capture_output=True,
            timeout=30
Confidence
86% confidence
Finding
The code launches PowerShell with a script path supplied from the command line, which means whoever invokes this Python script can cause execution of any local PowerShell script. Although arguments are passed as a list rather than through a shell string, this still exposes arbitrary code execution capability beyond simple metadata lookup and makes the workflow depend on a highly privileged external interpreter.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill describes capabilities to read local files, write large amounts of output, and invoke shell/PowerShell scripts, but it does not declare permissions or boundaries for those actions. This creates a real security risk because an agent may perform sensitive filesystem and subprocess operations without explicit user-visible consent and scope restrictions.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
This function is designed to execute an external PowerShell script provided at runtime, giving the skill a generic code-execution primitive rather than a narrowly scoped book-search operation. In a skill intended to scan and annotate ebooks, that broader execution surface is unnecessary and increases the chance of abuse if an attacker can influence invocation parameters or package contents.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger conditions are broad natural-language phrases such as scanning books, organizing ebooks, or importing to Obsidian, which could cause the skill to activate in contexts the user did not intend. Because this skill can read local files, perform network searches, and write outputs, accidental invocation increases the chance of unintended data exposure or filesystem changes.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill combines local library scanning, online lookup, and bulk note generation, but the documentation does not warn users that local filenames/metadata may be transmitted to external services or that many files will be created. In this context, missing risk disclosure is meaningful because ebook libraries can contain sensitive reading-history or personally identifying information.

Unvalidated Output Injection

High
Category
Output Handling
Content
Python调用PowerShell传递中文参数时：
```python
result = subprocess.run(
    ['powershell', '-File', script_path, '-Keyword', keyword],
    capture_output=True,
    timeout=30
Confidence
79% confidence
Finding
The skill passes a variable keyword into a PowerShell subprocess for a search workflow, and the surrounding design indicates the value can derive from book metadata or user-controlled input. Even though `subprocess.run` is shown with an argument list, invoking PowerShell with untrusted input is still dangerous because downstream script handling, PowerShell parameter parsing, or secondary command construction in `search_book.ps1` can turn this into command/argument injection or unsafe script execution.

Static analysis

No suspicious patterns detected.